base/bif/plugins/Bro_DHCP.events.bif.bro
-
GLOBAL
| Namespace: | GLOBAL |
|---|---|
| Source File: | /scripts/base/bif/plugins/Bro_DHCP.events.bif.bro |
Summary
Events
dhcp_ack: event |
Generated for DHCP messages of type DHCPACK (Server to client with configuration parameters, including committed network address). |
dhcp_decline: event |
Generated for DHCP messages of type DHCPDECLINE (Client to server indicating network address is already in use). |
dhcp_discover: event |
Generated for DHCP messages of type DHCPDISCOVER (client broadcast to locate available servers). |
dhcp_inform: event |
Generated for DHCP messages of type DHCPINFORM (Client to server, asking only for local configuration parameters; client already has externally configured network address). |
dhcp_nak: event |
Generated for DHCP messages of type DHCPNAK (Server to client indicating client’s notion of network address is incorrect (e.g., client has moved to new subnet) or client’s lease has expired). |
dhcp_offer: event |
Generated for DHCP messages of type DHCPOFFER (server to client in response to DHCPDISCOVER with offer of configuration parameters). |
dhcp_release: event |
Generated for DHCP messages of type DHCPRELEASE (Client to server relinquishing network address and cancelling remaining lease). |
dhcp_request: event |
Generated for DHCP messages of type DHCPREQUEST (Client message to servers either (a) requesting offered parameters from one server and implicitly declining offers from all others, (b) confirming correctness of previously allocated address after, e.g., system reboot, or (c) extending the lease on a particular network address.) |
Detailed Interface
Events
-
dhcp_ack Type: event(c:connection, msg:dhcp_msg, mask:addr, router:dhcp_router_list, lease:interval, serv_addr:addr, host_name:string)Generated for DHCP messages of type DHCPACK (Server to client with configuration parameters, including committed network address).
C: The connection record describing the underlying UDP flow. Msg: The parsed type-independent part of the DHCP message. Mask: The subnet mask specified by the message. Router: The list of routers specified by the message. Lease: The least interval specified by the message. Serv_addr: The server address specified by the message. Host_name: Optional host name value. May differ from the host name requested from the client. See also:
dhcp_discover,dhcp_offer,dhcp_request,dhcp_decline,dhcp_nak,dhcp_release,dhcp_inform
-
dhcp_decline Type: event(c:connection, msg:dhcp_msg, host_name:string)Generated for DHCP messages of type DHCPDECLINE (Client to server indicating network address is already in use).
C: The connection record describing the underlying UDP flow. Msg: The parsed type-independent part of the DHCP message. Host_name: Optional host name value. See also:
dhcp_discover,dhcp_offer,dhcp_request,dhcp_ack,dhcp_nak,dhcp_release,dhcp_informNote
Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.
-
dhcp_discover Type: event(c:connection, msg:dhcp_msg, req_addr:addr, host_name:string)Generated for DHCP messages of type DHCPDISCOVER (client broadcast to locate available servers).
C: The connection record describing the underlying UDP flow. Msg: The parsed type-independent part of the DHCP message. Req_addr: The specific address requested by the client. Host_name: The value of the host name option, if specified by the client. See also:
dhcp_discover,dhcp_offer,dhcp_request,dhcp_decline,dhcp_ack,dhcp_nak,dhcp_release,dhcp_informNote
Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.
-
dhcp_inform Type: event(c:connection, msg:dhcp_msg, host_name:string)Generated for DHCP messages of type DHCPINFORM (Client to server, asking only for local configuration parameters; client already has externally configured network address).
C: The connection record describing the underlying UDP flow. Msg: The parsed type-independent part of the DHCP message. Host_name: The value of the host name option, if specified by the client. See also:
dhcp_discover,dhcp_offer,dhcp_request,dhcp_decline,dhcp_ack,dhcp_nak,dhcp_releaseNote
Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.
-
dhcp_nak Type: event(c:connection, msg:dhcp_msg, host_name:string)Generated for DHCP messages of type DHCPNAK (Server to client indicating client’s notion of network address is incorrect (e.g., client has moved to new subnet) or client’s lease has expired).
C: The connection record describing the underlying UDP flow. Msg: The parsed type-independent part of the DHCP message. Host_name: Optional host name value. See also:
dhcp_discover,dhcp_offer,dhcp_request,dhcp_decline,dhcp_ack,dhcp_release,dhcp_informNote
Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.
-
dhcp_offer Type: event(c:connection, msg:dhcp_msg, mask:addr, router:dhcp_router_list, lease:interval, serv_addr:addr, host_name:string)Generated for DHCP messages of type DHCPOFFER (server to client in response to DHCPDISCOVER with offer of configuration parameters).
C: The connection record describing the underlying UDP flow. Msg: The parsed type-independent part of the DHCP message. Mask: The subnet mask specified by the message. Router: The list of routers specified by the message. Lease: The least interval specified by the message. Serv_addr: The server address specified by the message. Host_name: Optional host name value. May differ from the host name requested from the client. See also:
dhcp_discover,dhcp_request,dhcp_decline,dhcp_ack,dhcp_nak,dhcp_release,dhcp_informNote
Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.
-
dhcp_release Type: event(c:connection, msg:dhcp_msg, host_name:string)Generated for DHCP messages of type DHCPRELEASE (Client to server relinquishing network address and cancelling remaining lease).
C: The connection record describing the underlying UDP flow. Msg: The parsed type-independent part of the DHCP message. Host_name: The value of the host name option, if specified by the client. See also:
dhcp_discover,dhcp_offer,dhcp_request,dhcp_decline,dhcp_ack,dhcp_nak,dhcp_inform
-
dhcp_request Type: event(c:connection, msg:dhcp_msg, req_addr:addr, serv_addr:addr, host_name:string)Generated for DHCP messages of type DHCPREQUEST (Client message to servers either (a) requesting offered parameters from one server and implicitly declining offers from all others, (b) confirming correctness of previously allocated address after, e.g., system reboot, or (c) extending the lease on a particular network address.)
C: The connection record describing the underlying UDP flow. Msg: The parsed type-independent part of the DHCP message. Req_addr: The client address specified by the message. Serv_addr: The server address specified by the message. Host_name: The value of the host name option, if specified by the client. See also:
dhcp_discover,dhcp_offer,dhcp_decline,dhcp_ack,dhcp_nak,dhcp_release,dhcp_informNote
Bro does not support broadcast packets (as used by the DHCP protocol). It treats broadcast addresses just like any other and associates packets into transport-level flows in the same way as usual.
